Security

Last updated: August 9, 2026

How we build

We design and operate Nexsus Growth systems with the following practices:

Access control

• Administrative areas require authentication, and staff accounts support time-based two-factor authentication.
• Access is role-based: each account sees only the data and actions its role requires.
• Session tokens are signed with asymmetric keys and rotated on refresh.

Data in transit and at rest

• All traffic is served over HTTPS.
• Our database and file storage providers encrypt data at rest.
• Credentials and API keys are stored as environment variables, never in source control.

Application hardening

• Public forms are protected against automated abuse and rate limited.
• Inputs are validated at the API boundary.
• Administrative and scheduled endpoints require authenticated, constant-time credential checks.

Backups

• The production database is backed up daily.
• Backups are stored with a separate provider, under a separate credential, so a problem with the main system does not reach them.
• Every backup is encrypted before it leaves the host.
• We test that a backup can actually be restored, and record the result.

Logging and monitoring

• Security-relevant events are recorded in an audit log.
• Application errors and performance are monitored continuously.
• Logs are written with personal data redacted.

Where your data is held

We use third-party providers for hosting, database, file storage, email delivery, and error monitoring. Our providers are located outside Bangladesh, and data may be processed in those regions. Our Privacy Policy describes what we collect and why.

The full named list of our subprocessors, and the role each one plays, is published in our Privacy Policy. That page is updated when the list changes.

Reporting a vulnerability

We welcome reports from security researchers.

Email: security@nexsusgrowth.com
Machine-readable policy: https://nexsusgrowth.com/.well-known/security.txt

Please include steps to reproduce, the impact you believe it has, and any supporting evidence. Reports in English or Bengali are both fine.

What we commit to

• We will acknowledge your report within three business days.
• We will tell you our assessment, and whether we plan to fix it, within ten business days.
• We will keep you updated while we work on a fix.
• We will credit you publicly if you would like that, once the issue is resolved.
• We will not take legal action against you for research conducted in good faith under this policy.

Safe harbour

If you follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, and if a third party brings action against you for research that followed this policy, we will make that authorisation clear.

This authorisation does not extend to research that breaks this policy, and it cannot bind third parties whose systems you also touch.

In scope

• nexsusgrowth.com and its subdomains
• our public APIs
• our authentication, session, and authorisation logic
• our AI assistant, including prompt injection and data leakage between contexts

Out of scope

• denial of service, load testing, or anything that degrades service for others
• physical attacks, social engineering, or phishing our staff or customers
• automated scanner output submitted without a demonstrated impact
• findings that require a compromised device or a stolen credential
• reports about third-party services we use, which should go to those providers
• missing security headers or configuration weaknesses with no demonstrated exploit

What we ask

• Use only accounts you own, or test accounts you have created.
• Do not access, modify, or delete data belonging to anyone else.
• Stop as soon as you have confirmed a vulnerability, and do not go further than needed to demonstrate it.
• Give us reasonable time to fix an issue before disclosing it publicly, and coordinate the timing with us.
• Do not extract, retain, or publish personal data you encounter.

We do not currently run a paid bug bounty programme. We are grateful for reports regardless, and we credit researchers who ask for it.

If you believe your data has been affected

Contact security@nexsusgrowth.com. If we determine a breach affects personal data, we will notify affected people and any regulator we are required to notify, without undue delay.